Extracted

Extracted

• • Target

    ce52be438bc12fbf4f796bd5856ddd1b496b6e35abeabd075d0ade053d3425a6

  • Size

    762KB

  • MD5

    8206150ffac4406dfbf7202b6d90590d

  • SHA1

    b73b791ed6a213d2a4d11358bcf05f5c99b97a99

  • SHA256

    ce52be438bc12fbf4f796bd5856ddd1b496b6e35abeabd075d0ade053d3425a6

  • SHA512

    37c085f2c66bbab227feb8f8a7b74839ef932a6ce8992f06efdd213e3ff853e71f42e2fa1bc438d51395ee12e2e26fc9d535d43eb4c859ce149418bf208bb8bd

  • SSDEEP

    12288:1Mrfy90SCTeY/rF7tF9QoXtWg7Sk45TNU2jvsjer/7XE21+TEJ8ekoRxCD1ItRbf:mytlerFr97dVcjvsjeLbGE69owuFpsqX

  Score

  10^/10

  redlinecr2dunmdiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    evasiontrojan

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Suspicious use of SetThreadContext

  behavioral1